CVS commit: pkgsrc/security/libgcrypt

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Aug 27 05:28:02 UTC 2026

Modified Files:
        pkgsrc/security/libgcrypt: Makefile distinfo

Log Message:
libgcrypt: updated to 1.12.3

Noteworthy changes in version 1.12.3 (2026-08-26)

* Bug fixes:

  - Avoid theoretical drive-by loading of netapi32.dll and
    shell32.dll.
  - Validate hash algorithm for use with RSA modulus.
  - Validate parameters of Balloon KDF.
  - Validate parallelism of Argon2 KDF.
  - Fix parsing quoted parts and CRLF/LFCR in s-expression.
  - Support BUFLEN check for GCRYMPI_FMT_SSH.
  - Fix RSA PSS verify message length checking.
  - Avoid a NULL ptr deref due to a unsupported genkey flag for
    ECC.
  - Assert 32 KiB input cap in gcm_ctr_encrypt.
  - Fix assertion failure in OCB when a buffered block becomes block
    65536.
  - Fix OOB read in IMIT MAC verify of GOST28147.
  - Fix CMAC block-count truncation for 64 GiB writes.
  - Fix AEAD spurious byte-counter carry for 4 GiB adds.
  - Validate all KEM input lengths.
  - Add length check of DATALEN when parsing s-expression.
  - Only accept canonical value for S with EdDSA.
  - Only accept canonical signatures for RSA.
  - Fix an assertion failure for invalid small-order Ed25519 public
    keys.
  - Validate length of supplied receiver public-key length in DHKEM
    decapsulation.
  - Use a more strict value for the PKCS#1 minimal frame length.

* Performance:

  - Use just strong random for the Dilithium signature nonce and the
    Kyber encapsulation coins.
  - Allow internal users to skip fast random poll for ciphers and
    hashes.
  - Speedup sntrup761 by defer reduction in polynomial multiplication,
    reading random with a single call, and reducing freeze helpers
    w/o division.
  - Avoid byte-wise load/store on RISC-V with Zicclsm.
  - Use unaligned vector memory access on RSIV-V when supported.
  - Add Intel SM4 instructions accelerated AVX512 and AVX2
    implementation.
  - Add Intel SM3 extension implementation.
  - Add Intel SHA512 extension implementation.

* Other:

  - kyber: Accept and return a seed using the gcry_pk_genkey API.
  - Add curve "ietf25" as alternative to "Curve25519" with exact
    RFC-8410 semantics.  The name "X25519" was already used as an
    alias, thus this new name.
  - Add straight-line speculation hardening for function ends.
  - Fix constant time memequal check for SM2.
  - Add post-quantum algorithm benchmarking to bench-slope.
  - Due to the minor API updates and but with no newer branch
    released the SO name has been updated.


To generate a diff of this commit:
cvs rdiff -u -r1.124 -r1.125 pkgsrc/security/libgcrypt/Makefile
cvs rdiff -u -r1.107 -r1.108 pkgsrc/security/libgcrypt/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/libgcrypt/Makefile
diff -u pkgsrc/security/libgcrypt/Makefile:1.124 pkgsrc/security/libgcrypt/Makefile:1.125
--- pkgsrc/security/libgcrypt/Makefile:1.124    Thu Apr 16 12:44:40 2026
+++ pkgsrc/security/libgcrypt/Makefile  Thu Aug 27 05:28:02 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.124 2026/04/16 12:44:40 adam Exp $
+# $NetBSD: Makefile,v 1.125 2026/08/27 05:28:02 adam Exp $
 
-DISTNAME=      libgcrypt-1.12.2
+DISTNAME=      libgcrypt-1.12.3
 CATEGORIES=    security
 MASTER_SITES=  ${MASTER_SITE_GNUPG:=libgcrypt/}
 EXTRACT_SUFX=  .tar.bz2

Index: pkgsrc/security/libgcrypt/distinfo
diff -u pkgsrc/security/libgcrypt/distinfo:1.107 pkgsrc/security/libgcrypt/distinfo:1.108
--- pkgsrc/security/libgcrypt/distinfo:1.107    Thu Apr 16 12:44:40 2026
+++ pkgsrc/security/libgcrypt/distinfo  Thu Aug 27 05:28:02 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.107 2026/04/16 12:44:40 adam Exp $
+$NetBSD: distinfo,v 1.108 2026/08/27 05:28:02 adam Exp $
 
-BLAKE2s (libgcrypt-1.12.2.tar.bz2) = 1250b51d06f40e0c7a0bce04f37830c12e50d2965776c6137a21ada3d49bc3fb
-SHA512 (libgcrypt-1.12.2.tar.bz2) = dc1a4a6c00a0d84d90c8d71f4bd121b968c80df74137d6e8867f1f4cc014a539efb5238c1a1429d7cb95e493a40718fc19252edc592ffe0f43057b372896591c
-Size (libgcrypt-1.12.2.tar.bz2) = 4441855 bytes
+BLAKE2s (libgcrypt-1.12.3.tar.bz2) = 134abaf0f1b8a591d91404d2aced890df2d9798acf031d3a1687ccbb29bfcbb9
+SHA512 (libgcrypt-1.12.3.tar.bz2) = 84c150730af55669e35d3d9109250ae28175da1b506de84117701464ac5c7e542163977a1eb2e5df4cdaa8c723ea759aa8c004cccc98251902482aff7f847cad
+Size (libgcrypt-1.12.3.tar.bz2) = 4472486 bytes
 SHA1 (patch-src_libgcrypt-config.in) = 2b791d7ebe51c52ece864b23dcbeae5354701263